The present invention relates to a system, composed of a plurality of computers connected via a network, for integrating pieces of log information, each piece of which is independently held by each of the plurality of computers.
At present, a system that provides a user with services such as on-line shopping on the Internet is coming into widespread use. Using a mechanism of WWW (World Wide Web) of the system, the user can receive the services by accessing a Web server which is a computer providing the services through a general-purpose browser used for the WWW.
At an early stage, contents of the services mainly include basic and simple services of information providing type such as information retrieval services. Today, more complicated services are being provided, including online shopping services for selling and purchasing commodities and services accompanied by actual movement of money, and online banking services that enable a user to do business with a bank.
The system on the server side providing the services conventionally has only the Web server. However, for the purpose of providing users with such complicated services, not only the Web server but also several kinds of servers are placed in the system on a function basis. One system as a general example is constituted of three kinds of servers as follows: a Web server for generating information to be given to a user; an application server for controlling actual flows of operations; and a database server for storing operations data such as stock information and account information.
In addition, since the Internet basis services provided to users are designed to be freely utilized at any time a user wants to, accesses from many users are sometimes concentrated. Therefore, it is necessary to make a design that provides a system on the server side with sufficient performance. Such a case generally takes a configuration in which a plurality of servers of similar kind are connected to achieve an increase in performance, instead of using one server.
As described above, a today's Web system includes two or more kinds of servers having different functions, wherein there are a plurality of servers belonging to each kind. If such a system configuration is used, a set of history information about processing of a certain user is dispersively stored in a plurality of pieces of log information, each piece of which is independently output as a file by each server.
Such systems for managing system operation include, as a function of supporting an administrator, a function whereby log information which the administrator wants to obtain is obtained through simple operation using an integration management consol that displays system configurations on the server side in a list format, and thereby the log information is presented.
In the prior art, Japanese Patent Laid-open No. 2001-356939 proposes a method for facilitating the analysis of log information. In the method, various kinds of log information are converted into an intermediate format, are subsequently sorted and merged in order of time, and then statistical information such as the frequency of appearance of a keyword in the log information is provided to the administrator at a time.
The conventional methods described above have the following problems. To be more specific, one piece of log information which can usually be viewed by the administrator at a time includes only a part of history information on a processing flow which the administrator really wants to view. In other words, in order to enable the administrator to keep track of the total processing, the following work is required: obtaining all log information which is output by all related servers; collecting information considered to be related to from among the all log information; and estimating a process flow. However, in the complicated system such as the today's Web system, the work is considered to be practically impossible.
Moreover, if the method that uses the frequency of appearance of a keyword described in the prior art is applied, the log information integrated in order of time is mixed with log information that has been accidentally recorded at the same time, with the result that the mixed log information is presented to the administrator. Accordingly, it is not possible to obtain only processing history information that the administrator really needs. For example, if a plurality of users utilize a Web server simultaneously, log information as a result of an access by each user is successively recorded in a log file simply in order of time. Therefore, the log information made by the two users cannot be separated by use of the order of time. To be more specific, although referring to all log information is required to enable the administrator to keep track of system operation, it is not possible to track a process flow by a simple merge and a sort in order of time.